CVE-2026-45662: Dokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion)
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.0 and earlier, the deleteRegistry function in Dokploy (packages/server/src/services/registry.ts) executes docker logout ${response.registryUrl} without shell escaping. In the same file, the docker login command correctly uses shEscape() to prevent command injection. This inconsistency creates a command injection vulnerability when deleting a registry with a crafted registryUrl.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify deleteRegistry in packages/server/src/services/registry.ts so that the value inserted into the docker logout command is properly shell-escaped (for example, by calling shEscape() on response.registryUrl) or otherwise sanitized to prevent command injection.
Dokploy (server - registry service) docker logout invocation = use shEscape(response.registryUrl) or equivalent shell-escaping/sanitization - Configuration
Implement server-side validation and sanitization for registryUrl values accepted by the registry deletion API: allow only expected hostname/URL formats and reject values containing shell metacharacters or unexpected characters to prevent injection vectors.
Dokploy (server - registry service) registryUrl input validation = enforce strict validation (allow only expected hostnames/URLs, reject shell metacharacters)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45662?
The severity of CVE-2026-45662 is classified as high with a score of 8.8.
How do I fix CVE-2026-45662?
To fix CVE-2026-45662, update Dokploy to version 0.29.1 or later to ensure proper shell escaping.
What type of vulnerability is CVE-2026-45662?
CVE-2026-45662 is classified as an OS Command Injection vulnerability.
What component of Dokploy is affected by CVE-2026-45662?
CVE-2026-45662 affects the deleteRegistry function in Dokploy's registry service.
What are the potential impacts of CVE-2026-45662?
The potential impacts of CVE-2026-45662 include unauthorized command execution and registry deletion due to insufficient shell escaping.